freeswan and ipsec

"Peter Marshall" <[email protected]> Fri, 15 Oct 2004 14:41:47 -0300
Newsgroups gmane.comp.security.vpn
Message-ID <[email protected]>
I am still having problems getting freeswan (on rh9) to work properly with
ipsec on openbsd.  It works perfect when I run it between 2 rh9 boxes ...
however, I need it to work between rh9 and openbsd .....

On the openbsd console after I try to connect the two I get these messages
(A.B.C.102 is a routable Internet IP addreses)
Oct 15 11:29:04 mailtestlx isakmpd[7395]: message_recv: invalid cookie(s)
19708ba516163430 5429d55714d51b23
Oct 15 11:29:04 mailtestlx isakmpd[7395]: dropped message from A.B.C.102
port 500 due to notification type INVALID_COOKIE
Oct 15 11:29:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:31:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:33:27 mailtestlx isakmpd[7395]: transport_send_messages: giving up
on message 0x3c05da00
Oct 15 11:43:27 mailtestlx last message repeated 5 times

On the Rh9 box, I get this in the /var/log/secure file   (A.B.C.? and
E.F.G.? are routable Internet IP addreses)
Oct 15 14:19:50 pmarshallx pluto[17009]: "bsdtest" #69: cannot respond to
IPsec SA request because no connection is known for
A.B.C.0/22===A.B.C.102...E.F.G.33===E.F.G.0/26
Oct 15 14:19:57 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)
Oct 15 14:20:06 pmarshallx pluto[17009]: "bsdtest" #69: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0xf619efa3 (perhaps this is a duplicated packet)

This is that I type on the linux box to start ipsec
[root@pmarshallx log]# /etc/init.d/ipsec start
ipsec_setup: Starting FreeS/WAN IPsec 2.06...
[root@pmarshallx log]# ipsec auto --up bsdtest
112 "bsdtest" #2: STATE_QUICK_I1: initiate
004 "bsdtest" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
{ESP=>0x707d73c4 <0xb492011f}

This is what I type on the bsdbox
# isakmpd
#

This is the ipsec.conf file on the linux box
# basic configuration
config setup
        interfaces="ipsec0=eth0"
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        # klipsdebug=all
        # plutodebug=dns

conn bsdtest
        #auto=start
        auto=add
        type=tunnel
        keyexchange=ike
        left=E.F.G.33
        leftsubnet=192.168.200.0/21
        leftnexthop=E.F.G.3
        right=A.B.C.102
        rightsubnet=10.0.0.0/24
        rightnexthop=A.B.192.1
        authby=secret
        pfs=yes


This is the isakmpd.conf file on the openbsd box
[General]
Listen-on=E.F.G.33

[Phase 1]
A.B.C.102=     ISAKMP-peer-B

[Phase 2]
Connections=    IPsec-AB

[ISAKMP-peer-B]
Phase  =  1
Transport =  udp
Local-address = E.F.G.33
Address = A.B.C.102
Configuration = Default-main-mode
Authentication = mypassword

[IPsec-AB]
Phase = 2
ISAKMP-peer = ISAKMP-peer-B
Configuration = Default-quick-mode
Local-ID = Net-LOCAL
Remote-ID = Net-HOST2

[Default-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = 3DES-SHA

[Default-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = QM-ESP-AES-SHA-PFS-SUITE

[Net-LOCAL]
ID-type = IPV4_ADDR_SUBNET
Network = E.F.G.33
Netmask = 255.255.255.192

[Net-HOST2]
ID-type = IPV4_ADDR_SUBNET
Network = A.B.C.102
Netmask = 255.255.252.0
~


Any Help Would be greatly appriciated.

Thanks

Peter Marshall